1. Field of the Invention
The present invention relates to fault tolerant clock distribution systems, and more particularly to a clock distribution system which utilizes redundant clock sourcing circuitry, redundant AC and DC power sources, and redundant clock distribution circuitry to ensure continuous clocking of redundant circuit loads.
2. Description of the Prior Art
Modern digital circuitry and computer systems often require the use of synchronous clock distribution systems. Synchronous systems are digital systems where the operations are controlled by continuous, periodic clock pulses. This allows activity within the system to occur at a fixed time relative to the clock pulses.
In electronic circuitry requiring digital synchronous clock signals, it is known to use a plurality of clock sourcing circuits in which a voting method is used to select one of the clock sourcing circuits as the primary clock signal. An example of such a circuit is U.S. Pat. No. 4,644,498, by Bedard et al., issued Feb. 17, 1987. This type of circuit simply has an odd number of identical clock sourcing circuits, each powered by a separate power supply, so that the failure of a minority of the clock sourcing circuits or power supplies will not cause the entire system to fail. These circuits provide a particular circuit load with one clock signal which has been selected by way of the voting scheme.
It is also known to use synchronizing circuitry to synchronize a slave clock signal with a master clock signal so that the triggering edges of any slave clock signal pulses occur at the same time, and will track the frequency of the master clock. Such a circuit is disclosed in U.S. Pat. No. 5,036,528, by Costantino et al., issued Jul. 30, 1991. In the Costantino circuit, the loss of voltage to the master clock will result in the loss of all clock sourcing capability. Phase detection has also been used to determine whether the clock signals are in phase with one another, and if not, the synchronizer resynchronizes the clock signals.
Some digital circuit loads may control or store data which, if lost, would result in catastrophic consequences. For example, a circuit load comprising a dynamic memory would lose all data if the supplying voltage source were to fail or become disconnected. For this reason, the present invention clocks a system which utilizes redundant circuit loads each powered by separate voltage sources, so that the failure of a voltage source does not result in the loss of the system data. Furthermore, the failure of a circuit load itself will not result in the loss of the valuable data, since the redundant circuit load would be storing a duplicate copy of the data. In order to accomplish a redundant circuit load system such as this, a circuit load and its clock sourcing and synchronizing circuitry must be powered by a voltage source which is isolated from the redundant circuit load, clock sourcing circuitry, and synchronizing circuitry. Therefore, a separate clock signal in each "power domain" must clock its associated circuit load so that the loss of the voltage source, the synchronizing circuitry, or the circuit load will not result in the loss of system data. (A "power domain" refers to the circuitry driven by the same voltage source and voltage bus.) These two separate clock signals also need to be synchronized with one another across the power domain boundary so that each circuit load is clocked at precisely the same time in order to maintain the same data or perform the same function in each of the two circuit loads. A single clock source chosen from voting on a number of identical clock sourcing circuits, such as the Bedard patent, would not provide a solution to the problem of simultaneously clocking two circuit loads in separate power domains, since each circuit load must be clocked by a separate clock. A voting scheme simply ensures that the failure of a minority of the clock sourcing circuits will not result in the total loss of the resultant clock signal. The present invention provides redundant clock sourcing circuits, each of which are powered by separate voltage sources, in order to simultaneously clock multiple circuit loads which are also powered by separate voltage sources. This allows continued system performance in the event of a clock source failure or a circuit load failure.
Furthermore, a single synchronizer which synchronizes an incoming clock signal with a local clock, such as the Costantino patent, is not acceptable in a system which utilizes fully redundant power domains. In the system being clocked by the present invention, a separate synchronizer is required in each power domain which synchronizes the clock signal from its power domain with those clock signals from other power domains. This ensures that one clock signal will clock its respective circuit load at precisely the same time as the other clock signals clock their respective loads. Therefore, the failure of a circuit load will not result in a catastrophic loss of data, since a separate clock signal had been ensuring simultaneous activity in a redundant circuit load prior to the failure of the defective circuit load.
The present invention provides such redundant synchronization across multiple power domain boundaries, and provides redundancy of clock signals to redundant circuit loads byway of dual synchronized clock signals rather than by voting upon a majority of identical clock signals, or by synchronizing with a local clock. This invention was driven by the need for higher reliability through the use of a clock distribution system which can simultaneously provide clock drive to redundant, individually powered circuit loads. The present invention also provides redundancy in clock signal connections to their respective circuit loads, so that the disconnection of a connection does not deprive the circuit load of clock signals.
In order to make such a fully redundant clock distribution system complete, detection of clock signal errors is required. The present invention provides skew fault detection to monitor and control each of the redundant clock signals, and allow an operational clock signal to replace a faulty clock signal without any data corruption at the circuit load. This redundancy in clock distribution, coupled with the capability to clock redundant circuit loads, results in a digital system which can remain completely operational even in light of multiple failures.